The framework
Peru's framework rests on Law 29733 on Personal Data Protection + 2024 Regulation, adopted in 2011, with the ANPD as the supervisory authority.
That puts Peru in the global opt-in majority, where permission comes before processing and marketing waits for consent.
Key instruments
Law 29733 on Personal Data Protection + 2024 Regulation
Peru enforces more than its size suggests, with express-consent formalism, a database registration regime, and a fully rewritten regulation in force since March 2025 that reaches cookies, biometric data and digital services directly. Its duty to appoint data protection officers phases in by company size from November 2026.
Marketing and advertising
Prior, express, unequivocal consent is the default, one of the region's strictest standards; the 2024 regulation (effective 30 March 2025) modernized notices, cookies and children's rules. That single sentence decides most channel plans here.
Cross-border transfers
Transfers abroad must be registered with the authority and turn on the adequacy of the destination.
Enforcement and penalties
Fines up to 100 UIT (S/550,000, about USD 160,000) for very serious infractions, actively imposed.